“THE right to be left alone.” For many this phrase, made famous by Louis Brandeis, an American Supreme Court justice, captures the essence of a notoriously slippery, but crucial concept. Drawing the boundaries of privacy has always been tricky. Most people have long accepted the need to provide some information about themselves in order to vote, work, shop, pursue a business, socialise or even borrow a library book. But exercising control over who knows what about you has also come to be seen as an essential feature of a civilised society.
Totalitarian excesses have made “Big Brother” one of the 20th century’s most frightening bogeymen. Some right of privacy, however qualified, has been a major difference between democracies and dictatorships. An explicit right to privacy is now enshrined in scores of national constitutions as well as in international human-rights treaties. Without the “right to be left alone”, to shut out on occasion the prying eyes and importunities of both government and society, other political and civil liberties seem fragile. Today most people in rich societies assume that, provided they obey the law, they have a right to enjoy privacy whenever it suits them.
They are wrong. Despite a raft of laws, treaties and constitutional provisions, privacy has been eroded for decades. This trend is now likely to accelerate sharply. The cause is the same as that which alarmed Brandeis when he first popularised his phrase in an article in 1890: technological change. In his day it was the spread of photography and cheap printing that posed the most immediate threat to privacy. In our day it is the computer. The quantity of information that is now available to governments and companies about individuals would have horrified Brandeis. But the power to gather and disseminate data electronically is growing so fast that it raises an even more unsettling question: in 20 years’ time, will there be any privacy left to protect?
Most privacy debates concern media intrusion, which is also what bothered Brandeis. And yet the greatest threat to privacy today comes not from the media, whose antics affect few people, but from the mundane business of recording and collecting an ever-expanding number of everyday transactions. Most people know that information is collected about them, but are not certain how much. Many are puzzled or annoyed by unsolicited junk mail coming through their letter boxes. And yet junk mail is just the visible tip of an information iceberg. The volume of personal data in both commercial and government databases has grown by leaps and bounds in recent years along with advances in computer technology. The United States, perhaps the most computerised society in the world, is leading the way, but other countries are not far behind.
Advances in computing are having a twin effect. They are not only making it possible to collect information that once went largely unrecorded, but are also making it relatively easy to store, analyse and retrieve this information in ways which, until quite recently, were impossible.
Just consider the amount of information already being collected as a matter of routine—any spending that involves a credit or bank debit card, most financial transactions, telephone calls, all dealings with national or local government. Supermarkets record every item being bought by customers who use discount cards. Mobile-phone companies are busy installing equipment that allows them to track the location of anyone who has a phone switched on. Electronic toll-booths and traffic-monitoring systems can record the movement of individual vehicles. Pioneered in Britain, closed-circuit TV cameras now scan increasingly large swathes of urban landscapes in other countries too. The trade in consumer information has hugely expanded in the past ten years. One single company, Acxiom Corporation in Conway, Arkansas, has a database combining public and consumer information that covers 95% of American households. Is there anyone left on the planet who does not know that their use of the Internet is being recorded by somebody, somewhere?
Firms are as interested in their employees as in their customers. A 1997 survey by the American Management Association of 900 large companies found that nearly two-thirds admitted to some form of electronic surveillance of their own workers. Powerful new software makes it easy for bosses to monitor and record not only all telephone conversations, but every keystroke and e-mail message as well.
Information is power, so it is hardly surprising that governments are as keen as companies to use data-processing technology. They do this for many entirely legitimate reasons—tracking benefit claimants, delivering better health care, fighting crime, pursuing terrorists. But it inevitably means more government surveillance.
A controversial law passed in 1994 to aid law enforcement requires telecoms firms operating in America to install equipment that allows the government to intercept and monitor all telephone and data communications, although disputes between the firms and the FBI have delayed its implementation. Intelligence agencies from America, Britain, Canada, Australia and New Zealand jointly monitor all international satellite-telecommunications traffic via a system called “Echelon” that can pick specific words or phrases from hundreds of thousands of messages.
America, Britain, Canada and Australia are also compiling national DNA databases of convicted criminals. Many other countries are considering following suit. The idea of DNA databases that cover entire populations is still highly controversial, but those databases would be such a powerful tool for fighting crime and disease that pressure for their creation seems inevitable. Iceland’s parliament has agreed a plan to sell the DNA database of its population to a medical-research firm, a move bitterly opposed by some on privacy grounds.
The general public may be only vaguely aware of the mushrooming growth of information-gathering, but when they are offered a glimpse, most people do not like what they see. A survey by America’s Federal Trade Commission found that 80% of Americans are worried about what happens to information collected about them. Skirmishes between privacy advocates and those collecting information are occurring with increasing frequency.
This year both Intel and Microsoft have run into a storm of criticism when it was revealed that their products—the chips and software at the heart of most personal computers—transmitted unique identification numbers whenever a personal-computer user logged on to the Internet. Both companies hastily offered software to allow users to turn the identifying numbers off, but their critics maintain that any software fix can be breached. In fact, a growing number of electronic devices and software packages contain identifying numbers to help them interact with each other.
In February an outcry greeted news that Image Data, a small New Hampshire firm, had received finance and technical assistance from the American Secret Service to build a national database of photographs used on drivers’ licences. As a first step, the company had already bought the photographs of more than 22m drivers from state governments in South Carolina, Florida and Colorado. Image Data insists that the database, which would allow retailers or police across the country instantly to match a name and photograph, is primarily designed to fight cheque and credit-card fraud. But in response to more than 14,000 e-mail complaints, all three states moved quickly to cancel the sale.
It is always hard to predict the impact of new technology, but there are several developments already on the horizon which, if the recent past is anything to go by, are bound to be used for monitoring of one sort or another. The paraphernalia of snooping, whether legal or not, is becoming both frighteningly sophisticated and easily affordable. Already, tiny microphones are capable of recording whispered conversations from across the street. Conversations can even be monitored from the normally imperceptible vibrations of window glass. Some technologists think that the tiny battlefield reconnaissance drones being developed by the American armed forces will be easy to commercialise. Small video cameras the size of a large wasp may some day be able to fly into a room, attach themselves to a wall or ceiling and record everything that goes on there.
Overt monitoring is likely to grow as well. Intelligent software systems are already able to scan and identify individuals from video images. Combined with the plummeting price and size of cameras, such software should eventually make video surveillance possible almost anywhere, at any time. Street criminals might then be observed and traced with ease.
The burgeoning field of “biometrics” will make possible cheap and fool-proof systems that can identify people from their voices, eyeballs, thumbprints or any other measurable part of their anatomy. That could mean doing away with today’s cumbersome array of security passes, tickets and even credit cards. Alternatively, pocket-sized “smart” cards might soon be able to store all of a person’s medical or credit history, among other things, together with physical data needed to verify his or her identity.
In a few years’ time utilities might be able to monitor the performance of home appliances, sending repairmen or replacements even before they break down. Local supermarkets could check the contents of customers’ refrigerators, compiling a shopping list as they run out of supplies of butter, cheese or milk. Or office workers might check up on the children at home from their desktop computers.
But all of these benefits, from better medical care and crime prevention to the more banal delights of the “intelligent” home, come with one obvious drawback—an ever-widening trail of electronic data. Because the cost of storing and analysing the data is also plummeting, almost any action will leave a near-permanent record. However ingeniously information-processing technology is used, what seems certain is that threats to traditional notions of privacy will proliferate.
America’s consumer-credit laws, passed in the 1970s, give individuals the right to examine their credit records and to demand corrections. The European Union has recently gone a lot further. The EU Data Protection directive, which came into force last October, aims to give people control over their data, requiring “unambiguous” consent before a company or agency can process it, and barring the use of the data for any purpose other than that for which it was originally collected. Each EU country is pledged to appoint a privacy commissioner to act on behalf of citizens whose rights have been violated. The directive also bars the export of data to countries that do not have comparably stringent protections.
Most EU countries have yet to pass the domestic laws needed to implement the directive, so it is difficult to say how it will work in practice. But the Americans view it as Draconian, and a trade row has blown up about the EU’s threat to stop data exports to the United States. A compromise may be reached that enables American firms to follow voluntary guidelines; but that merely could create a big loophole. If, on the other hand, the EU insists on barring data exports, not only might a trade war be started but also the development of electronic commerce in Europe could come screeching to a complete halt, inflicting a huge cost on the EU’s economy.
If consumers were to become more alarmed about privacy, however, market solutions could offer some protection. The Internet, the frontline of the privacy battlefield, has already spawned anonymous remailers, firms that forward e-mail stripped of any identifying information. One website (www.anonymizer.com) offers anonymous Internet browsing. Electronic digital cash, for use on or off the Internet, may eventually provide some anonymity but, like today’s physical cash, it will probably be used only for smaller purchases.
John Hagel and Marc Singer of McKinsey, a management consulting firm, believe that from such services will emerge “infomediaries”, firms that become brokers of information between consumers and other companies, giving consumers privacy protection and also earning them some revenue for the information they are willing to release about themselves. If consumers were willing to pay for such brokerage, infomediaries might succeed on the Internet. Such firms would have the strongest possible stake in maintaining their reputation for privacy protection. But it is hard to imagine them thriving unless consumers are willing to funnel every transaction they make through a single infomediary. Even if this is possible—which is unclear—many consumers may not want to rely so much on a single firm. Most, for example, already have more than one credit card.
The idea sounds disconcerting, he admits. But he argues that privacy is doomed in any case. Transparency would enable people to know who knows what about them, and for the ruled to keep an eye on their rulers. Video cameras would record not only criminals, but also abusive policemen. Corporate chiefs would know that information about themselves is as freely available as it is about their customers or workers. Simple deterrence would then encourage restraint in information gathering—and maybe even more courtesy.
Yet Mr Brin does not explain what would happen to transparency violators or whether there would be any limits. What about national-security data or trade secrets? Police or medical files? Criminals might find these of great interest. What is more, transparency would be just as difficult to enforce legally as privacy protection is now. Indeed, the very idea of making privacy into a crime seems outlandish.
There is unlikely to be a single answer to the dilemma posed by the conflict between privacy and the growing power of information technology. But unless society collectively turns away from the benefits that technology can offer—surely the most unlikely outcome of all—privacy debates are likely to become ever more intense. In the brave new world of the information age, the right to be left alone is certain to come under siege as never before.
Copyright © 2001 The Economist Newspaper and The Economist Group. All rights reserved.